Lucene search
+L

1134377 matches found

Cvelist
Cvelist
added 2026/07/13 9:5 p.m.35 views

CVE-2026-58411 ChurchCRM has Reflected Cross-Site Scripting (XSS) via unsanitized request parameter names and values

ChurchCRM is an open-source church management system. Prior to version 7.4.0, Cross-Site Scripting XSS vulnerabilities were identified due to insufficient output encoding of user-controlled request parameter names and parameter values. The application reflects attacker-controlled input into...

7CVSS0.00347EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2026/07/13 9:5 p.m.5 views

CVE-2026-58411

ChurchCRM is an open-source church management system. Prior to version 7.4.0, Cross-Site Scripting XSS vulnerabilities were identified due to insufficient output encoding of user-controlled request parameter names and parameter values. The application reflects attacker-controlled input into...

7CVSS6.1AI score0.00347EPSS
SaveExploits0References2Affected Software1
OSV
OSV
added 2026/07/13 9:5 p.m.4 views

CVE-2026-58411 ChurchCRM has Reflected Cross-Site Scripting (XSS) via unsanitized request parameter names and values

ChurchCRM is an open-source church management system. Prior to version 7.4.0, Cross-Site Scripting XSS vulnerabilities were identified due to insufficient output encoding of user-controlled request parameter names and parameter values. The application reflects attacker-controlled input into...

7CVSS6.1AI score0.00347EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB
added 2026/07/13 8:30 p.m.5 views

CVE-2026-15595

A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0. The affected element is an unknown function of the file /forsubject.php. This manipulation of the argument subject causes cross site scripting. It is possible to initiate the attack remotely. The exploit has...

5.3CVSS4.8AI score0.00278EPSS
SaveExploits0References6Affected Software1
CVE
CVE
added 2026/07/13 8:30 p.m.23 views

CVE-2026-15595

Technical details about CVE-2026-15595 are not publicly available in the provided documents. Monitor for updates.

5.3CVSS4.8AI score0.00278EPSS
SaveExploits0References6
Cvelist
Cvelist
added 2026/07/13 8:30 p.m.44 views

CVE-2026-15595 SourceCodester Class and Exam Timetabling System forsubject.php cross site scripting

A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0. The affected element is an unknown function of the file /forsubject.php. This manipulation of the argument subject causes cross site scripting. It is possible to initiate the attack remotely. The exploit has...

5.3CVSS0.00278EPSS
SaveExploits0References6
NVD
NVD
added 2026/07/13 8:16 p.m.5 views

CVE-2026-12536

The Avada Fusion Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Module Title’ parameter in all versions up to, and including, 3.15.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

6.4CVSS0.00168EPSS
SaveExploits0References2
IBM Security Bulletins
IBM Security Bulletins
added 2026/07/13 8:16 p.m.14 views

Security Bulletin: IBM Security QRadar Log Management AQL Plugin is vulnerable to using components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. IBM Security QRadar Log Management AQL Plugin has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-34077 DESCRIPTION: React...

8.8CVSS6.9AI score0.00535EPSS
SaveExploits1Affected Software1
Cvelist
Cvelist
added 2026/07/13 7:33 p.m.32 views

CVE-2026-12536 Avada Builder <= 3.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Title

The Avada Fusion Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Module Title’ parameter in all versions up to, and including, 3.15.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

6.4CVSS0.00168EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2026/07/13 7:33 p.m.4 views

CVE-2026-12536

The Avada Fusion Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Module Title’ parameter in all versions up to, and including, 3.15.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

6.4CVSS6.2AI score0.00168EPSS
SaveExploits0References3
CVE
CVE
added 2026/07/13 7:33 p.m.15 views

CVE-2026-12536

CVE-2026-12536 : A Stored Cross-Site Scripting flaw in the Avada (Fusion) Builder plugin for WordPress affects all versions up to 3.15.5. It arises from insufficient input sanitization and output escaping in the Module Title parameter. An authenticated attacker with Contributor-level access or hi...

6.4CVSS6.2AI score0.00168EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/07/13 6:13 p.m.36 views

CVE-2026-49971 Laravel-Mediable < 7.0.0 Stored XSS via SVG File Upload

Laravel-Mediable before 7.0.0 contains a stored cross-site scripting vulnerability that allows authenticated or anonymous users to execute arbitrary JavaScript by uploading unsanitized SVG files containing embedded scripts in onload event handlers, script tags, or foreignObject elements. Attacker...

6.1CVSS0.00203EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB
added 2026/07/13 6:13 p.m.7 views

CVE-2026-49971

Laravel-Mediable before 7.0.0 contains a stored cross-site scripting vulnerability that allows authenticated or anonymous users to execute arbitrary JavaScript by uploading unsanitized SVG files containing embedded scripts in onload event handlers, script tags, or foreignObject elements. Attacker...

6.1CVSS6.3AI score0.00203EPSS
SaveExploits0References4
OSV
OSV
added 2026/07/13 6:13 p.m.5 views

CVE-2026-49971 Laravel-Mediable < 7.0.0 Stored XSS via SVG File Upload

Laravel-Mediable before 7.0.0 contains a stored cross-site scripting vulnerability that allows authenticated or anonymous users to execute arbitrary JavaScript by uploading unsanitized SVG files containing embedded scripts in onload event handlers, script tags, or foreignObject elements. Attacker...

5.3CVSS6.3AI score0.00203EPSS
SaveExploits0References6
Cvelist
Cvelist
added 2026/07/13 6:4 p.m.38 views

CVE-2026-58228 Scheme validation bypass in Phoenix.LiveView.Utils leads to XSS via <.link>

Cross-site scripting vulnerability in phoenixframework phoenixliveview allows an attacker to bypass URL scheme validation and execute JavaScript in a victim's browser session. The Phoenix.LiveView.Utils.validdestination!/2 and Phoenix.LiveView.Utils.validlivenavigationdestination!/2 functions in...

5CVSS0.00382EPSS
SaveExploits0References4
ATTACKERKB
ATTACKERKB
added 2026/07/13 6:4 p.m.6 views

CVE-2026-58228

Cross-site scripting vulnerability in phoenixframework phoenixliveview allows an attacker to bypass URL scheme validation and execute JavaScript in a victim's browser session. The Phoenix.LiveView.Utils.validdestination!/2 and Phoenix.LiveView.Utils.validlivenavigationdestination!/2 functions in...

5CVSS6.2AI score0.00382EPSS
SaveExploits0References5Affected Software1
CVE
CVE
added 2026/07/13 6:4 p.m.20 views

CVE-2026-58228

Summary: CVE-2026-58228 affects phoenix_live_view (Phoenix.LiveView.Utils) and enables XSS via due to scheme validation bypass. The root cause is the internal uri_scheme/1 helper in Phoenix.LiveView.Utils that only detects schemes when the first byte is an ASCII letter; inputs starting with ASCI...

5CVSS6.2AI score0.00382EPSS
SaveExploits0References4
OSV
OSV
added 2026/07/13 6:4 p.m.6 views

CVE-2026-58228 Scheme validation bypass in Phoenix.LiveView.Utils leads to XSS via <.link>

Cross-site scripting vulnerability in phoenixframework phoenixliveview allows an attacker to bypass URL scheme validation and execute JavaScript in a victim's browser session. The Phoenix.LiveView.Utils.validdestination!/2 and Phoenix.LiveView.Utils.validlivenavigationdestination!/2 functions in...

5CVSS6.2AI score0.00382EPSS
SaveExploits0References9
OSV
OSV
added 2026/07/13 5:54 p.m.8 views

GHSA-465G-4Q99-5X86 NukeViet: Multiple Anti-XSS Filter Bypasses Leading to Stored XSS in News Module

Summary Two filter-bypass techniques in NukeViet\Core\Request::filterAttr and NukeViet\Core\Request::unhtmlentities allow a low-privileged user any account with news post permission to store and serve arbitrary JavaScript to any visitor of the affected page. Affected Component...

8.7CVSS6.3AI score
SaveExploits0References2
Cvelist
Cvelist
added 2026/07/13 5:23 p.m.32 views

CVE-2026-61504 Rejetto HFS < 3.2.1 Stored XSS via File Names in Basic Web Listing

Rejetto HFS 3.0.0 through 3.2.0 does not escape file names in its fallback "basic" web listing, and this listing can be forced by any browser via the ?get=basic parameter. A user with upload permission - or an anonymous user on servers with an open upload folder - can store a file whose name...

5.4CVSS0.00173EPSS
SaveExploits0References2
Rows per page
Query Builder